CVE-2016-3728: High severity foreman vulnerability
Published May 20, 2016
·Updated
Eval injection vulnerability in tftpapi.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATHINFO to tftp/.
Affected Software
6 affected components
theforeman foreman=1.11.0
theforeman foreman=1.11.0-rc1
theforeman foreman=1.11.0-rc2
theforeman foreman=1.11.0-rc3
theforeman foreman=1.11.1
theforeman foreman=1.10.3
Event History
May 20, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3728?
CVE-2016-3728 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2016-3728?
To mitigate CVE-2016-3728, upgrade your Foreman installation to version 1.10.4 or 1.11.2 and later.
3
What software versions are affected by CVE-2016-3728?
CVE-2016-3728 impacts Foreman versions 1.10.0 to 1.10.3 and 1.11.0 to 1.11.1.
4
What type of attack does CVE-2016-3728 allow?
CVE-2016-3728 allows remote attackers to execute arbitrary code through an Eval injection vulnerability.
5
Is CVE-2016-3728 easy to exploit?
Yes, CVE-2016-3728 can be easily exploited by sending crafted requests targeting the TFTP module.